Identity-Based Lateral Movement

During a penetration test of a financial technology vendor's environment, the testing team began with a single compromised developer credential obtained through a simulated phishing attack. The subsequent lateral movement path required no vulnerability exploitation , only identity and permission traversal. The compromised developer account was in the 'engineering' Azure AD group. The engineering group had been granted read access to the organization's HashiCorp Vault secrets manager to enable developers to retrieve database connection strings for testing. The Vault contained the staging database credentials. The staging database had a bidirectional replication configuration with the production database that was configured for disaster recovery purposes. The staging database credentials provided read access to the production database through the replication link , access that the developer would never need and that had not been evaluated as an attack path when the replication was configured. The penetration test team went from a developer's Azure AD credential to production database access in four permission hops, spending less than two hours in the environment and triggering no alerts. Every individual permission was legitimate. The permission path that combined them was not evaluated as an attack vector by any previous security review.

What is Identity-Based Lateral Movement, Really?

Identity-based lateral movement is the technique of traversing an environment by chaining legitimate identity and permission steps , using one set of valid credentials to obtain another, using access to one resource to discover or access credentials for another, and progressively building toward a high-value target through a sequence of individually authorized steps. Unlike vulnerability-based lateral movement, which exploits technical weaknesses to escalate privilege, identity-based lateral movement exploits the permission graph , the network of identity relationships, credential stores, and access grants that connect systems in ways their designers may not have evaluated as attack paths.

The permission graph problem is the core challenge. Modern enterprise environments are connected through hundreds of identity relationships , group memberships that grant access to shared resources, service accounts that bridge application tiers, credential stores that hold secrets for other systems, federation relationships that extend trust across environments, and automation tools that traverse boundaries under delegated credentials. Each relationship was created for a legitimate operational purpose. The attack path that chains multiple relationships in sequence to reach an unintended destination was created as a side effect of each individual relationship's existence , it was never designed, never approved, and frequently never evaluated.

The individual permission adequacy trap is what makes lateral movement detection difficult from a governance perspective. Access reviews that evaluate each permission independently against the role that holds it will confirm that each permission is appropriate. The developer having secrets manager read access for their legitimate development work is appropriate. What the review did not evaluate is whether that permission, combined with the secrets manager's contents and the downstream systems those contents enable access to, creates an unintended path to high-value resources. Permission-by-permission review is necessary but not sufficient. Permission graph analysis , evaluating the paths that combinations of permissions create , is the governance complement that most organizations have not implemented.

• Credential store access as lateral movement pivot , permissions to access secrets managers, password managers, or key vaults providing credentials for additional systems
• Group membership chaining , membership in one group providing access to resources that provide access to additional resources
• Replication and synchronization links , database, directory, or storage replication creating access paths between systems with different security classifications
• Service account traversal , service accounts bridging security domains, providing a lateral movement pathway between environments
• Federation trust chains , federated identity relationships extending attacker access beyond the initial compromise environment

Why this matters

Identity-based lateral movement matters for TPRM because vendor environments with access to customer systems are precisely the environments where a credential compromise could cascade through permission chains to reach customer data or infrastructure. A vendor whose individual access controls are well-designed but whose permission graph has not been analyzed may have unintended lateral movement paths that connect a compromised developer credential to a customer production environment through intermediate permissions that are individually legitimate.

The supply chain attack amplification is the most consequential dimension. An attacker who compromises a vendor developer credential and can laterally move through the vendor's permission graph to reach the vendor's customer environment access mechanisms has turned a single developer credential into multi-customer access. The lateral movement path from developer to CI/CD pipeline to deployment credentials to customer environment is a well-documented attack pattern that exploits permission chains rather than vulnerabilities.

Where most teams get this wrong

The most consistent failure is evaluating permissions in isolation rather than as a graph. Individual permission reviews confirm that each permission is appropriate for the role that holds it. They do not analyze what the combination of permissions creates as an attack path. Graph-based analysis , asking what a compromised identity can reach by chaining legitimate permissions , is the evaluation that reveals lateral movement paths that individual permission review misses.

• Evaluating permissions in isolation rather than as a graph
• No permission graph analysis , lateral movement paths not evaluated
• Credential store access not evaluated as lateral movement pivot
• Replication and sync links not analyzed as cross-boundary paths
• Penetration testing not including identity-based lateral movement as a test objective

What good looks like

Mature identity security programs include permission graph analysis , regularly analyzing what high-value destinations can be reached from any starting credential through combinations of legitimate permissions, and identifying and remediating the paths that were not intended to exist.

• Permission graph analysis tools , visualizing what can be reached from each identity through legitimate permission chains
• Blast radius analysis , for each compromised identity scenario, modeling what can be reached
• Credential store access restrictions , limiting who can read credential stores to the minimum required
• Replication and sync link access evaluation , analyzing cross-boundary paths created by synchronization
• Penetration testing with lateral movement objectives , specifically testing permission chain traversal

Tooling

Identity Attack Path Analysis , BloodHound, BloodHound Enterprise, Semperis

BloodHound was originally developed to analyze Active Directory permission graphs for attack paths , visualizing the relationships between accounts, groups, and resources that create unintended lateral movement paths. BloodHound Enterprise extends this to Azure AD and hybrid environments. For TPRM practitioners, asking whether the vendor uses attack path analysis tooling to identify lateral movement paths in their permission graph provides a specific identity graph security assessment question.

Cloud Permission Analysis , Wiz, Orca, Veza

Cloud security platforms provide permission graph analysis for cloud environments , analyzing IAM role chains, resource access policies, and service account permissions to identify paths from low-privilege identities to high-value resources. For TPRM practitioners, asking whether the vendor's cloud security tooling includes permission graph analysis for lateral movement path detection provides a specific cloud identity risk question.

Governance challenges

The governance challenge with identity-based lateral movement is the analysis complexity. Permission graphs in enterprise environments are large, complex, and change continuously as permissions are added and modified. Point-in-time analysis finds the paths that exist at that point. Continuous analysis requires automated tooling that maintains a current graph and flags new paths as they emerge. Manual permission review cannot scale to graph-level analysis , it requires tooling purpose-built for the problem.

• Ask whether attack path analysis is performed , BloodHound or equivalent for permission graph analysis
• Ask about blast radius assessment , what can be reached from a compromised developer credential
• Ask about credential store access controls , who can read the secrets manager and what it contains
• Ask about penetration testing lateral movement objectives , whether identity chain traversal is a defined test scope
• Include lateral movement analysis in vendor security assessment

If you are a small team

Ask your highest-risk vendors one question that forces lateral movement thinking: starting from a compromised developer credential, what is the longest permission chain that leads to your highest-sensitivity customer data , how many legitimate permission hops does it take? That question requires the vendor to think about their permission graph rather than their individual permission controls, and the honest answer reveals whether lateral movement paths have been analyzed or whether only individual permissions have been reviewed.

• Ask the lateral movement scenario question , how many hops from developer credential to most sensitive data
• Ask whether BloodHound or equivalent attack path analysis has been run
• Ask whether penetration testing includes identity-based lateral movement as a test objective
• Ask about credential store access controls and what credentials the store contains

What to require

Ask directly:

"Have you performed permission graph analysis , using BloodHound or equivalent tooling , to identify lateral movement paths that could allow a compromised low-privilege credential to reach high-value resources through chains of legitimate permissions?"

"Starting from a compromised developer credential, how many legitimate permission hops would it take to reach your most sensitive customer data , and have those paths been evaluated and remediated?"

Expect as evidence

• Attack path analysis tool and last analysis date
• Lateral movement path remediation records
• Credential store access restriction documentation
• Penetration test scope confirmation including lateral movement objectives

A vendor who confirms strong individual access controls should be asked whether those controls have been analyzed as a graph , specifically, whether the paths that combine multiple legitimate permissions to reach unintended destinations have been identified and remediated. Individual permissions are the nodes. The attack paths are the edges. Assessing only the nodes leaves the edges unexamined.

How to evidence it

• Attack path analysis records
• Lateral movement path remediation documentation
• Penetration test lateral movement scope
• Credential store access controls

Key Takeaway

Individual permissions are the nodes. Attack paths are the edges. Individual access review assesses every node and confirms each one is appropriate. It does not analyze the paths that chains of appropriate nodes create. The developer's access to the secrets manager is appropriate. The secrets manager's staging credentials are appropriate. The staging-to-production replication is appropriate for DR. The combination creates a four-hop path from developer credential to production database that was never evaluated, never approved, and triggered no alerts when traversed. Permission graph analysis finds the paths that exist between individually appropriate permissions. It is the governance complement that individual access review cannot provide. Ask whether the graph has been analyzed. The attack lives in the edges.

More on Security

• API Identity Misuse
• Access Certification Effectiveness
• Access Policy Misconfigurations